MX Firewall HA Deployment Using LAN IP

[TerryVasquez]

Hi Guys, Is there are a way that we can set up MX firewalls in HA using the LAN IP instead of the WAN IP? The setup will be, 2 MX firewalls on different geolocations. Site 1 will be the primary active and Site 2 will be the secondary passive. Sites are connected through a layer 2 Metro Ethernet link. Since the MX firewalls are on different locations, they have its own ISPs. What will happen is that, when the Metro Ethernet breaks, both MX should went up as active. When the Metro Ethernet became connected again, the MX at Site 2 will become passive again.

[jdsilva]

I don't follow what you mean by set up using the LAN IP?

What you're trying to do can be done. Set up the MXes in Warm Spare, but do not configure a VIP on the WAN side. Just leave the MXes using their own individual WAN IP's. 

On the LAN side the MXes will just use VRRP as they would in any Warm Spare config. You'll need to make sure that the LAN interfaces are all on that L2 extension you have so the VRRP heartbeats can reach each MX. 

I have a conceptual diagram I did for this a while ago... Let me see if I can dig it up.

[jdsilva]

I think this is what you're asking?

If you configure Warm Spare with "Use MX uplink IPs" each MX will keep its own WAN IP and not use a VIP.

But if you configure it with "Use virtual uplink IPs" then you need to have the WAN interfaces in the same WAN subnet at the same location.

You're going to want the former, not the latter.

[kYutobi]

@jdsilva is right. You should be able to just get the LAN IP if a DHCP server is present or you give it a LAN address. I've tried it on my side and got our internal LAN address which I statically changed to our WAN IP. 

[TerryVasquez]

I have that kind of HA on my other side thanks. But I need is a different one. What I need is on the LAN side not in the WAN/uplink side. If possible to have VRRP on LAN side so that may static routes from my Catalust switches will just point to the MX LAN VIP.

[TerryVasquez]

Anyways I have talked with Meraki TAC and says that it is not possible to have VRRP on the LAN side. Thanks guys for the help though. Appreciate it.

[jdsilva]

Huh? That's totally wrong. As soon as you configure Warm Spare it automatically enables VRRP for all LAN IP's on the MX. It's not even an option to not do that. 

I'm confused about the ask here... 😞

[jdsilva]

Are you trying to do something like this?

[TerryVasquez]

More likely that one, but the switches are connected to a layer-2 Metro Ethernet link. It is a flat network wherein all VLans at Site 1 are propagated as well on Site 2. Networks on Site1 are also in Site2. It is a mirrored setup actually. Warm spare will have VRRP at the LAN side, and the switches static route will point towards to the VRRP IP.

[jdsilva]

Right. My diagram above was logical. The physical version for the same topology would be this:

[TerryVasquez]

Corp VLANs A, B, and C are also at Site 2. When the MetroE/VPLS went down, both MX will become active. But when the MetroE/VPLS went up, Site 2 MX will become passive again.

[jdsilva]

Right, OK. We're talking about the same thing. 

VRRP is enabled for all LAN IP's on the MX pair as soon as you enable Warm Spare. It's automatic and not optional. 

https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#VRRP_He...

https://documentation.meraki.com/MX/Networks_and_Routing/NAT_HA_Failover_Behavior#VRRP_Mechanics_for...

[PhilipDAth]

>Corp VLANs A, B, and C are also at Site 2. When the MetroE/VPLS went down, both MX will become active

That is exactly what VRRP is meant to do ...

Note that having a single MetroE circuit for a design like this is flawed because of the danger of both nodes going active on a single circuit failure.  So you have a design issue.  To have redundancy you have to have two of everything.

An easy fix is to use a pair of MetroE circuits and simply LACP them together using a switch stack at each end.

[TerryVasquez]

Thanks bro for this. I've already read these articles as well.

Ok. So on our setup, the WAN uplinks are not in HA. Meaning, ISP1 is only for MX1 and ISP2 is only for MX2. Hence I cannot use the warm spare configuration that uses the uplinks.

Yes there will be VRRP on LAN side for the heartbeat. However in our setup, the LAN interfaces of the MX are configured with IP address (done by creating a VLAN x with y.y.y.y/24 address and associate that VLAN on a LAN port of the MX).

Let's say I have:

MX1

 - VLAN10: 10.10.10.2/24

 - Port 1 - access mode vlan 10

MX2

 - VLAN10: 10.10.10.3/24

 - Port 1 - access mode vlan 10

These MX's port 1 are connected on the switches. Behind the switches are L3 devices (e.g. router). I need to configure the routers to have a static route points to the VRRP IP of the MX so that when MX1 fails, the router at Site 1 will use MX2 and ISP2. if the MetroE goes down, both MX will go active.

[jdsilva]

---

@TerryVasquez wrote:

Thanks bro for this. I've already read these articles as well.

Ok. So on our setup, the WAN uplinks are not in HA. Meaning, ISP1 is only for MX1 and ISP2 is only for MX2. Hence I cannot use the warm spare configuration that uses the uplinks.

OK, this is where we're not syncing up. Yes you can. Set up Warm Spare with "Use uplink IPs" as described above. 

[jdsilva]

@TerryVasquez One more thing here though, I would strongly suggest you not have the same host VLANs and subnets at both sites. My design avoided this due to DHCP conflict problems that may arise upon reconnection of the L2 service. 

[TerryVasquez]

I'll try to configure the MX using the MX uplinks instead of the virtual uplink IPs. Unfortunately the sites were configured that way and I cannot change it as those are datacenters. It was designed as flat network so that when during business continuity drills, all IPs addresses and networks on Site1 is replicated at Site2. Appreciate you help bro. Thanks!

[jdsilva]

Cool. Let me know how it goes.